Mapping a Network Drive to an Azure File Share Using Domain Credentials

by Contributed | Mar 23, 2021 | Technology

This article is contributed. See the original author and article here.

Purpose:

The purpose of this post is to walk through the experience of configuring a Windows client to map a drive to an Azure File Share, with the User Experience that they are used to.  The process is documented in a multi-part article on Microsoft Docs. This post is meant to summarize the experience of going through this process and offer some guidance on areas that may be confusing.  The steps to complete this task along with notes on the experience will be listed below.

Assumptions:

Knowledge of creating Azure Storage Accounts, Azure File Shares, and Synchronizing on-premise Active Directory user accounts to Azure AD with Azure AD Connect is assumed.  It is also assumed that you have inserted data into the Azure File Share with a supported tool, like Azure File Sync, AzCopy, Windows Explorer, etc.  Depending on the security posture needed for a production environment, this configuration would likely have tighter access controls.  For our demonstration purposes, this configuration is being used for functionality and convenience.

Steps:

1. Join the Azure Storage Account containing the file share to AD (https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable) 

Run “Join-AzStorageAccountForAuth” cmdlet to join Storage account to Azure AD as shown here:

$ResourceGroupName = "My-Resource-Group-Name"
$StorageAccountName = "My-Sub-Name"
$Domain = "My-FQDN"
Import-Module -Name AzFilesHybrid
Join-AzStorageAccountForAuth `
        -ResourceGroupName $ResourceGroupName `
        -StorageAccountName $StorageAccountName `
        -DomainAccountType "ComputerAccount" # Default is set as ComputerAccount `
        -Domain $Domain

2. Sync AD Users that need to map the drives to Azure AD using Azure AD Connect. 

Note:  These accounts cannot be privileged accounts in Active Directory because Azure AD Connect will not sync those accounts to Azure AD.

3. Synchronize/Rotate Azure Storage Account AD Computer Object Password to your Azure Storage Account (https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-update-password).  

Note:  If you omit this process, your AD users will NOT be able to access the Azure File Share as intended

Connect-AzAccount -Environment "AzureCloud" #Adjust as-necessary
$ResourceGroupName = "My-Resource-Group-Name"
$StorageAccountName = "My-Sub-Name"
Ipmo AzFilesBybrid
Update-AzStorageAccountADObjectPassword `
        -RotateToKerbKey kerb2 `
        -ResourceGroupName $ResourceGroupName `
        -StorageAccountName $StorageAccountName

4. Assign share permissions:  Assign Azure Storage Share Level Access roles (“SMB Roles”) to sync’d AD Users (https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions)

Note:  There are three built-in Azure SMB Roles that can be used to control access at the Azure File Share Level.  These are share-level permissions; NTFS permissions do NOT control access at the Azure File Share level.

5. Administratively Modify/Assign NTFS permissions (Only If Needed):  The following scenarios will determine your path to assigning NTFS permissions: 
   
   
   
   1. Your permissions are fine and do not need modified:  Skip to Step 8
   
   
   2. Your permissions need to be changed and you have an AD Sync’d user that has the permissions to make the needed changes via mapped drive:  Skip to Step 8
   
   
   3. Your permissions need to be changed and you do NOT have a Sync’d user that has NTFS permissions to do it, follow the code block below:  Keep in mind that this method of mapping is using the storage account key and not a user account so proceed with caution. 
   
   
   
   

$StorageAccountName = "My-Sub-Name"
$AzureFileShare = "My-Share-Name"
$connectTestResult = Test-NetConnection -ComputerName "$StorageAccountName.file.core.windows.net" -Port 445
if ($connectTestResult.TcpTestSucceeded)
{
  net use X: "$StorageAccountName.file.core.windows.net$AzureFileShare" /user:Azure<StorageAcctName> '<StorageAccessKey>'
}
else
{
  Write-Error -Message "Unable to reach the Azure storage account via port 445. Check to make sure your organization or ISP is not blocking port 445, or use Azure P2S VPN,   Azure S2S VPN, or Express Route to tunnel SMB traffic over a different port."
}

6. If you used Step 5:  Set ACL’s on File system in Azure Share (https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-configure-permissions)

7. If you used Step 5:  Remove Drive Mapping Using Storage account key.  If you used the script from above, you can use the following script to remove the drive mapping as the storage account key.  This step is necessary so that you are able to successfully map the drive with your user account, as described in step 8. 

Note:  It is not recommended to keep the drive mapped with the Storage Account Key.

net use X: /DELETE

8. Map a drive to your Azure File Share using your AD user account (Windows Explorer, Command-Line, PowerShell, etc.)
   
   
   
   1. Once the drive is mapped, make any necessary NTFS ACL Changes as-needed. 
   
    
   
   


9. Troubleshooting:  If you encounter issues with this process, try the following tools for troubleshooting/debug information:
   
   
   
   1. https://docs.microsoft.com/en-us/azure/storage/files/storage-troubleshoot-windows-file-connection-problems#unable-to-mount-azure-files-with-ad-credentials
   
   
   2. Specifically, the following PowerShell command can expose many things that could be causing problems:
   
   
   
   

Connect-AzAccount -Environment "AzureCloud" #Adjust as-necessary
$ResourceGroupName = "My-Resource-Group-Name"
$StorageAccountName = "My-Sub-Name"
Ipmo AzFilesBybrid
Debug-AzStorageAccountAuth -StorageAccountName $StorageAccountName -ResourceGroupName $ResourceGroupName -Verbose

References:

Overview – On-premises AD DS authentication to Azure file shares | Microsoft Docs

Enable AD DS authentication to Azure file shares | Microsoft Docs

Control access to Azure file shares – on-premises AD DS authentication | Microsoft Docs

Control what a user can do at the file level – Azure file shares | Microsoft Docs

Mount Azure file share to an AD DS-joined VM | Microsoft Docs

Update AD DS storage account password | Microsoft Docs

Learn about the development of our favorite Visio solutions

by Contributed | Mar 23, 2021 | Technology

This article is contributed. See the original author and article here.

During the past three months, we posted a short series of whitepapers on the Visio Enthusiasts LinkedIn group about the development history of some of our favorite Visio products and capabilities. But since that group is private, you might have missed it.

Now, all three whitepapers from our under-the-hood series are available for you to download at the bottom of this blog post. We’ve also included a short summary of each, so you can read about the product or capability that’s most interesting to you (although we hope you’ll read all three).

The Visio Enthusiasts group is a great place to interact with other professional diagrammers and the internal Visio product group. It’s also where you can find exclusive content, including an upcoming series about enabling remote work with Visio. Select the link above to send us a request to join. We hope to see you in there!

Data Visualizer: simple but powerful data visualization

Data visualization tools are essential for analyzing information, exposing unique data to everyone in the organization, and making data-driven decisions. To enable all this, we developed Data Visualizer, an easy-to-use tool that quickly converts your Excel process map data into visual diagrams. Read this whitepaper to learn how we tested early ideas before landing on the Data Visualizer wizard; taught the tool how to refresh diagrams, handle interactions, and write back to the source code; and, just last year, launched the Data Visualizer add-in for Visio.

Visio layout: automating flowchart layouts

With so many ways to visualize data, it can be difficult to find the best layout for an aesthetic diagram. That’s why we developed Visio layout, a set of algorithms that work in the background to help you make smart decisions about shapes and semantic logic. For example, if you insert a shape in a diagram, Visio layout will add the appropriate connectors; and if you remove that shape, it will connect the remaining shapes. Read this whitepaper to learn how we developed Visio layout to automate the design of professional-looking diagrams.

Visio for the web: from desktop to browser and beyond

Five years ago, you could only create and edit Visio diagrams on the desktop client. Sharing those diagrams required manual workarounds, making it difficult to gather, collate, and incorporate input from across the organization. It was these challenges that prompted the development of Visio for the web. This under-the-hood whitepaper takes you on the journey from Visio Viewer to the Visio web app and the design considerations it took to get there, from load time optimizations to extensibility.

For questions or feedback about Visio, please email us at tellvisio [at] microsoft.com. Keep visiting the Visio Tech Community and follow us Twitter to stay current on the latest Visio releases. Remember to join the Visio Enthusiasts LinkedIn group for access to exclusive content and networking opportunities with your diagramming peers. All three whitepapers mentioned in this blog are available to download below.